@aitne/daemon 0.1.0

package/dist/services/mcp/registry.js

@@ -0,0 +1,387 @@
+import { BACKEND_IDS } from "@aitne/shared";
+import { McpProbeResultSchema, mcpSecretBlobName, validateTransportShape, } from "./types.js";
+function parseStringArray(raw, fallback = []) {
+    // Callers (rowToServer) only invoke us with `string | null`; the null branch
+    // is kept for defensive future reuse but every current path guards above.
+    /* c8 ignore next */
+    if (raw == null)
+        return fallback;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return fallback;
+        return parsed.filter((v) => typeof v === "string");
+    }
+    catch {
+        return fallback;
+    }
+}
+function parseBackends(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((v) => typeof v === "string" && BACKEND_IDS.includes(v));
+    }
+    catch {
+        return [];
+    }
+}
+function parseProbeStatus(raw) {
+    if (!raw)
+        return null;
+    try {
+        return McpProbeResultSchema.parse(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+}
+function rowToServer(row) {
+    const toolAllowlist = row.tool_allowlist == null
+        ? null
+        : parseStringArray(row.tool_allowlist, []);
+    return {
+        id: row.id,
+        name: row.name,
+        transport: row.transport,
+        command: row.command,
+        args: row.args == null ? null : parseStringArray(row.args, []),
+        cwd: row.cwd,
+        url: row.url,
+        envKeys: parseStringArray(row.env_keys, []),
+        headerKeys: parseStringArray(row.header_keys, []),
+        backends: parseBackends(row.backends),
+        enabled: row.enabled === 1,
+        riskTier: row.risk_tier,
+        toolAllowlist,
+        lastProbeAt: row.last_probe_at,
+        lastProbeStatus: parseProbeStatus(row.last_probe_status),
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+export class DuplicateMcpServerError extends Error {
+    code = "duplicate_mcp_server";
+    constructor(id) {
+        super(`MCP server already exists: ${id}`);
+        this.name = "DuplicateMcpServerError";
+    }
+}
+export class McpServerNotFoundError extends Error {
+    code = "mcp_server_not_found";
+    constructor(id) {
+        super(`MCP server not found: ${id}`);
+        this.name = "McpServerNotFoundError";
+    }
+}
+export class InvalidMcpServerError extends Error {
+    code = "invalid_mcp_server";
+    constructor(message) {
+        super(message);
+        this.name = "InvalidMcpServerError";
+    }
+}
+export function listMcpServers(db) {
+    const rows = db
+        .prepare(`SELECT * FROM mcp_servers ORDER BY created_at ASC`)
+        .all();
+    return rows.map(rowToServer);
+}
+export function getMcpServer(db, id) {
+    const row = db
+        .prepare(`SELECT * FROM mcp_servers WHERE id = ?`)
+        .get(id);
+    return row ? rowToServer(row) : null;
+}
+export function anyMcpServerEnabled(db) {
+    // Tolerant to a missing `mcp_servers` table — unit tests construct minimal
+    // in-memory DBs that may omit it, and production migrations run before any
+    // caller reaches here, so a `no such table` surfacing here is always "no
+    // enabled servers" in practice.
+    try {
+        const row = db
+            .prepare(`SELECT 1 AS v FROM mcp_servers WHERE enabled = 1 LIMIT 1`)
+            .get();
+        return row?.v === 1;
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeBackends(backends) {
+    const seen = new Set();
+    for (const b of backends) {
+        if (BACKEND_IDS.includes(b)) {
+            seen.add(b);
+        }
+    }
+    return Array.from(seen);
+}
+/**
+ * Per-backend constraint: Codex's HTTP MCP schema only knows how to pass a
+ * bearer token through `bearer_token_env_var`, so any http/sse server
+ * targeting Codex can declare at most one header key, and it must be
+ * `Authorization` (case-insensitive). If we silently accepted
+ * `X-API-Key`-style headers here the generator would drop them at
+ * materialization time and the user would see opaque auth failures.
+ */
+function validateBackendCapabilities(input) {
+    if ((input.transport === "http" || input.transport === "sse") &&
+        input.backends.includes("codex")) {
+        const headers = input.headerKeys ?? [];
+        const nonBearer = headers.filter((h) => h.toLowerCase() !== "authorization");
+        if (nonBearer.length > 0) {
+            return {
+                ok: false,
+                message: "Codex HTTP transport supports only a single `Authorization` header. " +
+                    `Remove ${nonBearer.join(", ")} or drop Codex from the backends list.`,
+            };
+        }
+    }
+    return { ok: true };
+}
+export function insertMcpServer(db, input) {
+    const shape = validateTransportShape({
+        transport: input.transport,
+        command: input.command ?? null,
+        args: input.args ?? null,
+        url: input.url ?? null,
+    });
+    if (!shape.ok) {
+        throw new InvalidMcpServerError(shape.message);
+    }
+    const backends = normalizeBackends(input.backends);
+    if (backends.length === 0) {
+        throw new InvalidMcpServerError("backends must include at least one backend id");
+    }
+    const backendCheck = validateBackendCapabilities({
+        transport: input.transport,
+        backends,
+        headerKeys: input.headerKeys,
+    });
+    if (!backendCheck.ok) {
+        throw new InvalidMcpServerError(backendCheck.message);
+    }
+    const existing = getMcpServer(db, input.id);
+    if (existing) {
+        throw new DuplicateMcpServerError(input.id);
+    }
+    const now = Date.now();
+    db.prepare(`INSERT INTO mcp_servers (
+       id, name, transport, command, args, cwd, url,
+       env_keys, header_keys, backends, enabled, risk_tier,
+       tool_allowlist, last_probe_at, last_probe_status,
+       created_at, updated_at
+     ) VALUES (
+       @id, @name, @transport, @command, @args, @cwd, @url,
+       @env_keys, @header_keys, @backends, @enabled, @risk_tier,
+       @tool_allowlist, NULL, NULL,
+       @created_at, @updated_at
+     )`).run({
+        id: input.id,
+        name: input.name,
+        transport: input.transport,
+        command: input.command ?? null,
+        args: input.args ? JSON.stringify(input.args) : null,
+        cwd: input.cwd ?? null,
+        url: input.url ?? null,
+        env_keys: JSON.stringify(input.envKeys ?? []),
+        header_keys: JSON.stringify(input.headerKeys ?? []),
+        backends: JSON.stringify(backends),
+        enabled: input.enabled ? 1 : 0,
+        risk_tier: input.riskTier ?? "approve",
+        tool_allowlist: input.toolAllowlist ? JSON.stringify(input.toolAllowlist) : null,
+        created_at: now,
+        updated_at: now,
+    });
+    const saved = getMcpServer(db, input.id);
+    /* c8 ignore start — transactional insert just succeeded; the row must
+       exist. Defensive so a future caller that bypasses the insert path still
+       surfaces a loud error instead of returning `undefined`. */
+    if (!saved) {
+        throw new Error(`Failed to read back inserted mcp_server: ${input.id}`);
+    }
+    /* c8 ignore stop */
+    return saved;
+}
+export function updateMcpServer(db, id, patch) {
+    const current = getMcpServer(db, id);
+    if (!current)
+        throw new McpServerNotFoundError(id);
+    const next = {
+        ...current,
+        ...patch,
+        envKeys: patch.envKeys ?? current.envKeys,
+        headerKeys: patch.headerKeys ?? current.headerKeys,
+        backends: patch.backends
+            ? normalizeBackends(patch.backends)
+            : current.backends,
+        toolAllowlist: patch.toolAllowlist === undefined
+            ? current.toolAllowlist ?? null
+            : patch.toolAllowlist,
+        updatedAt: Date.now(),
+    };
+    const shape = validateTransportShape({
+        transport: next.transport,
+        command: next.command ?? null,
+        args: next.args ?? null,
+        url: next.url ?? null,
+    });
+    if (!shape.ok) {
+        throw new InvalidMcpServerError(shape.message);
+    }
+    if (next.backends.length === 0) {
+        throw new InvalidMcpServerError("backends must include at least one backend id");
+    }
+    const backendCheck = validateBackendCapabilities({
+        transport: next.transport,
+        backends: next.backends,
+        headerKeys: next.headerKeys,
+    });
+    if (!backendCheck.ok) {
+        throw new InvalidMcpServerError(backendCheck.message);
+    }
+    // If the wire-shape of the server changed (transport/command/args/url/cwd),
+    // the cached probe result no longer describes what will be reached on the
+    // next connect, so the dashboard would render stale tools. Clear it and
+    // require a fresh probe.
+    const shapeChanged = current.transport !== next.transport ||
+        current.command !== next.command ||
+        current.url !== next.url ||
+        current.cwd !== next.cwd ||
+        !stringArraysEqual(current.args ?? [], next.args ?? []);
+    db.prepare(`UPDATE mcp_servers SET
+       name = @name,
+       transport = @transport,
+       command = @command,
+       args = @args,
+       cwd = @cwd,
+       url = @url,
+       env_keys = @env_keys,
+       header_keys = @header_keys,
+       backends = @backends,
+       risk_tier = @risk_tier,
+       tool_allowlist = @tool_allowlist,
+       last_probe_at = CASE WHEN @invalidate_probe = 1 THEN NULL ELSE last_probe_at END,
+       last_probe_status = CASE WHEN @invalidate_probe = 1 THEN NULL ELSE last_probe_status END,
+       updated_at = @updated_at
+     WHERE id = @id`).run({
+        id,
+        name: next.name,
+        transport: next.transport,
+        command: next.command ?? null,
+        args: next.args ? JSON.stringify(next.args) : null,
+        cwd: next.cwd ?? null,
+        url: next.url ?? null,
+        env_keys: JSON.stringify(next.envKeys),
+        header_keys: JSON.stringify(next.headerKeys),
+        backends: JSON.stringify(next.backends),
+        risk_tier: next.riskTier,
+        tool_allowlist: next.toolAllowlist == null ? null : JSON.stringify(next.toolAllowlist),
+        invalidate_probe: shapeChanged ? 1 : 0,
+        updated_at: next.updatedAt,
+    });
+    /* c8 ignore next 2 — UPDATE just succeeded; unreachable. */
+    const saved = getMcpServer(db, id);
+    if (!saved)
+        throw new McpServerNotFoundError(id);
+    return saved;
+}
+function stringArraysEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        if (a[i] !== b[i])
+            return false;
+    }
+    return true;
+}
+export function setMcpServerEnabled(db, id, enabled) {
+    const existing = getMcpServer(db, id);
+    if (!existing)
+        throw new McpServerNotFoundError(id);
+    db.prepare(`UPDATE mcp_servers SET enabled = ?, updated_at = ? WHERE id = ?`).run(enabled ? 1 : 0, Date.now(), id);
+    /* c8 ignore next 2 — UPDATE just succeeded; unreachable. */
+    const saved = getMcpServer(db, id);
+    if (!saved)
+        throw new McpServerNotFoundError(id);
+    return saved;
+}
+export function deleteMcpServer(db, id) {
+    const result = db.prepare(`DELETE FROM mcp_servers WHERE id = ?`).run(id);
+    return result.changes > 0;
+}
+/**
+ * Kill switch — flip every `enabled=1` row to `enabled=0` in a single
+ * statement. Returns the count of rows actually changed so the caller
+ * (dashboard) can render a "disabled N servers" confirmation. Rows that
+ * were already disabled are not touched (SQL `WHERE enabled = 1`), so
+ * `updated_at` stays meaningful as "last user-driven state change".
+ */
+export function disableAllMcpServers(db) {
+    const result = db
+        .prepare(`UPDATE mcp_servers SET enabled = 0, updated_at = ? WHERE enabled = 1`)
+        .run(Date.now());
+    return result.changes;
+}
+export function saveMcpProbeResult(db, id, result) {
+    const existing = getMcpServer(db, id);
+    if (!existing)
+        throw new McpServerNotFoundError(id);
+    db.prepare(`UPDATE mcp_servers SET
+       last_probe_at = ?,
+       last_probe_status = ?,
+       updated_at = ?
+     WHERE id = ?`).run(Date.now(), JSON.stringify(result), Date.now(), id);
+    /* c8 ignore next 2 — UPDATE just succeeded; unreachable. */
+    const saved = getMcpServer(db, id);
+    if (!saved)
+        throw new McpServerNotFoundError(id);
+    return saved;
+}
+/* ------------------------------------------------------------------ *
+ * Per-server secret helpers (blob store)
+ * ------------------------------------------------------------------ */
+export async function getMcpSecret(blobStore, serverId, keyName) {
+    return blobStore.readUtf8(mcpSecretBlobName(serverId, keyName));
+}
+export async function setMcpSecret(blobStore, serverId, keyName, value) {
+    await blobStore.writeUtf8(mcpSecretBlobName(serverId, keyName), value);
+}
+export async function deleteMcpSecret(blobStore, serverId, keyName) {
+    await blobStore.remove(mcpSecretBlobName(serverId, keyName));
+}
+/**
+ * Delete every stored secret for this server — called after DELETE /api/mcp/servers/:id
+ * so orphaned blobs don't linger on disk. Callers iterate over `envKeys +
+ * headerKeys` captured *before* the DB row is deleted; this helper only takes
+ * the list of names so the registry never has to reason about transport.
+ */
+export async function deleteAllMcpSecrets(blobStore, serverId, keyNames) {
+    await Promise.all(keyNames.map((keyName) => deleteMcpSecret(blobStore, serverId, keyName)));
+}
+/**
+ * Resolve every secret this server declares, returning a flat record keyed
+ * by the variable/header name (`{ HA_TOKEN: "..." }`). Missing secrets are
+ * returned as `null`.
+ *
+ * NOTE — shape mismatch with generators: the config generators in
+ * `./generators/` expect `{ "<serverId>:<keyName>": value }` so secrets for
+ * multiple servers can coexist without env-var name collisions. When the
+ * Phase 3 session-workdir materializer calls the generators, it must build
+ * that scoped map explicitly. The unscoped shape returned here is designed
+ * for probe consumption, which only ever sees one server at a time.
+ */
+export async function resolveMcpSecrets(blobStore, server) {
+    const out = {};
+    const allKeys = [
+        ...(server.envKeys ?? []),
+        ...(server.headerKeys ?? []),
+    ];
+    await Promise.all(allKeys.map(async (keyName) => {
+        out[keyName] = await getMcpSecret(blobStore, server.id, keyName);
+    }));
+    return out;
+}
+//# sourceMappingURL=registry.js.map

package/dist/services/mcp/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/services/mcp/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,GAKvB,MAAM,YAAY,CAAC;AAkCpB,SAAS,gBAAgB,CAAC,GAAkB,EAAE,WAAqB,EAAE;IACnE,6EAA6E;IAC7E,0EAA0E;IAC1E,oBAAoB;IACpB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CACzC,OAAO,CAAC,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAiB;IACpC,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,IAAI,IAAI;QAC9C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAyB;QACxC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3C,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;QAC1B,QAAQ,EAAE,GAAG,CAAC,SAAwB;QACtC,aAAa;QACb,WAAW,EAAE,GAAG,CAAC,aAAa;QAC9B,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACxD,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAkBD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,sBAAsB,CAAC;IACvC,YAAY,EAAU;QACpB,KAAK,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,GAAG,sBAAsB,CAAC;IACvC,YAAY,EAAU;QACpB,KAAK,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,oBAAoB,CAAC;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,EAAqB;IAClD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,mDAAmD,CAAC;SAC5D,GAAG,EAAoB,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAqB,EACrB,EAAU;IAEV,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,wCAAwC,CAAC;SACjD,GAAG,CAAC,EAAE,CAA6B,CAAC;IACvC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAqB;IACvD,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,gCAAgC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CAAC,0DAA0D,CAAC;aACnE,GAAG,EAA+B,CAAC;QACtC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAqB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAK,WAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAAC,KAIpC;IACC,IACE,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC;QACzD,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAChC,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EACL,sEAAsE;oBACtE,UAAU,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;aACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,EAAqB,EACrB,KAAqB;IAErB,MAAM,KAAK,GAAG,sBAAsB,CAAC;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,qBAAqB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,YAAY,GAAG,2BAA2B,CAAC;QAC/C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ;QACR,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,EAAE,CAAC,OAAO,CACR;;;;;;;;;;OAUG,CACJ,CAAC,GAAG,CAAC;QACJ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACpD,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;QACtB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7C,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACnD,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;QACtC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;QAChF,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACzC;;iEAE6D;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,oBAAoB;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD,MAAM,UAAU,eAAe,CAC7B,EAAqB,EACrB,EAAU,EACV,KAAqB;IAErB,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAc;QACtB,GAAG,OAAO;QACV,GAAG,KAAK;QACR,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;QACzC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACtB,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;YACnC,CAAC,CAAC,OAAO,CAAC,QAAQ;QACpB,aAAa,EACX,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI;YAC/B,CAAC,CAAC,KAAK,CAAC,aAAa;QACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IAEF,MAAM,KAAK,GAAG,sBAAsB,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,qBAAqB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,YAAY,GAAG,2BAA2B,CAAC;QAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,yBAAyB;IACzB,MAAM,YAAY,GAChB,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACpC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAChC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QACxB,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QACxB,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE1D,EAAE,CAAC,OAAO,CACR;;;;;;;;;;;;;;;oBAegB,CACjB,CAAC,GAAG,CAAC;QACJ,EAAE;QACF,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAClD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI;QACrB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,cAAc,EACZ,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;QACxE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,UAAU,EAAE,IAAI,CAAC,SAAS;KAC3B,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAoB,EAAE,CAAoB;IACnE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAqB,EACrB,EAAU,EACV,OAAgB;IAEhB,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,OAAO,CACR,iEAAiE,CAClE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACvC,4DAA4D;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAqB,EAAE,EAAU;IAC/D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAqB;IACxD,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CAAC,sEAAsE,CAAC;SAC/E,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAAqB,EACrB,EAAU,EACV,MAAsB;IAEtB,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,OAAO,CACR;;;;kBAIc,CACf,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1D,4DAA4D;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;wEAEwE;AAExE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAA6B,EAC7B,QAAgB,EAChB,OAAe;IAEf,OAAO,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAA6B,EAC7B,QAAgB,EAChB,OAAe,EACf,KAAa;IAEb,MAAM,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAA6B,EAC7B,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA6B,EAC7B,QAAgB,EAChB,QAA2B;IAE3B,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAA6B,EAC7B,MAAwD;IAExD,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;KAC7B,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5B,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/services/mcp/risk.d.ts

@@ -0,0 +1,82 @@
+import { RiskTier } from "../../safety/risk-classifier.js";
+import type { McpRiskTier, McpServer } from "./types.js";
+/**
+ * B-003 Phase 3 — MCP tool risk helpers.
+ *
+ * A server carries an `McpRiskTier` (`read` / `approve`). That tier governs
+ * how the agent should treat every tool the server exposes. The mapping to
+ * the shared `RiskTier` enum is kept here (not in risk-classifier) because
+ * it is *not* an HTTP endpoint classification — it feeds session
+ * `disallowedTools` computation, not request routing.
+ *
+ * The legacy `notify` tier was abolished in DELEGATED-MODE-V2-DESIGN.md
+ * Phase 1 along with `RiskTier.Notify`. Per `clean-reinstall-no-migrations`
+ * policy, existing rows with `risk_tier='notify'` are not migrated — the
+ * schema CHECK constraint is updated to the 2-tier set and the user
+ * re-seeds via `pa stop && rm ~/.personal-agent/data.db && pa start`.
+ *
+ * Namespace convention per design: `mcp-tool:<serverId>:<toolName>`. The
+ * Claude Code SDK itself exposes MCP tools as `mcp__<serverId>__<toolName>`;
+ * we generate both forms (the namespace form for audit/log clarity, the
+ * double-underscore form for `disallowedTools` which the SDK matches).
+ */
+/** Convert a server's tier to the shared RiskTier enum. */
+export declare function classifyMcpServerTier(tier: McpRiskTier): RiskTier;
+/** Tool id as it appears in the Claude SDK `disallowedTools` list. */
+export declare function claudeMcpToolName(serverId: string, toolName: string): string;
+/** Tool id as it appears in audit logs / risk reasoning. */
+export declare function mcpToolNamespaceKey(serverId: string, toolName: string): string;
+/**
+ * Parse an MCP tool name. Two on-the-wire conventions are accepted:
+ *
+ *  1. `mcp__<serverId>__<toolName>` (double underscore) — emitted by
+ *     Claude SDK tool_use blocks and Codex `item.name` for MCP invocations.
+ *     The split is on the FIRST `__` after the `mcp__` prefix.
+ *  2. `mcp_<serverId>_<toolName>` (single underscore) — emitted by Gemini
+ *     CLI's `tool_name` field per the `MCP_TOOL_PREFIX = "mcp_"` constant
+ *     baked into Gemini's MCP runtime. Server ids may contain hyphens
+ *     (e.g. `google-workspace`) but never bare underscores, so the split
+ *     is on the FIRST `_` after the `mcp_` prefix.
+ *
+ * Returns null for non-MCP names or malformed inputs. Server ids are
+ * constrained by {@link McpServerIdSchema} to `[a-z0-9-]+`. Tool names
+ * are upstream-defined and may contain underscores or dots; everything
+ * after the chosen separator is treated as the tool name verbatim.
+ */
+export declare function parseMcpToolName(name: string): {
+    serverId: string;
+    toolName: string;
+} | null;
+export interface BuildMcpDisallowedToolsInput {
+    /** Enabled MCP servers targeting the session's backend. */
+    servers: readonly McpServer[];
+    /**
+     * Whether the session is autonomous (routine, scheduled task). Autonomous
+     * sessions cannot answer an `approve`-tier prompt, so every tool from an
+     * approve-tier server is stripped. Reactive (DM / dashboard chat) sessions
+     * keep the full palette — the owner is already in the loop.
+     */
+    autonomous: boolean;
+}
+/**
+ * Compute the set of MCP tool names that must be added to `disallowedTools`
+ * for this session. Two rules, independently applied (union):
+ *
+ *   1. `toolAllowlist` enforcement. When a server declares a non-null
+ *      allowlist, every probe-discovered tool *not* in the allowlist is
+ *      blocked — the agent must stay inside the curated subset.
+ *   2. Autonomous approve-tier strip. On autonomous ProcessKeys, every
+ *      probe-discovered tool from an `approve`-tier server is blocked so
+ *      the session cannot drive high-stakes actions without the owner in
+ *      the loop.
+ *
+ * Both rules use literal tool names from `lastProbeStatus.tools` — no
+ * wildcards. The Claude SDK's `disallowedTools` matcher for MCP names is
+ * literal, and a wildcard like `mcp__<id>__*` would also block legitimately
+ * allowlisted tools. The known trade-off: a tool added to the server after
+ * the last probe is NOT in this list, so the autonomous strip is weaker
+ * than a wildcard would be. Operationally the user re-probes after
+ * changing tools; the `rules/mcp.md` policy layer is the soft backstop.
+ */
+export declare function buildMcpDisallowedTools(input: BuildMcpDisallowedToolsInput): string[];
+//# sourceMappingURL=risk.d.ts.map

package/dist/services/mcp/risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAOjE;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuB/C;AAED,MAAM,WAAW,4BAA4B;IAC3C,2DAA2D;IAC3D,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,MAAM,EAAE,CAsBV"}

package/dist/services/mcp/risk.js

@@ -0,0 +1,126 @@
+import { RiskTier } from "../../safety/risk-classifier.js";
+/**
+ * B-003 Phase 3 — MCP tool risk helpers.
+ *
+ * A server carries an `McpRiskTier` (`read` / `approve`). That tier governs
+ * how the agent should treat every tool the server exposes. The mapping to
+ * the shared `RiskTier` enum is kept here (not in risk-classifier) because
+ * it is *not* an HTTP endpoint classification — it feeds session
+ * `disallowedTools` computation, not request routing.
+ *
+ * The legacy `notify` tier was abolished in DELEGATED-MODE-V2-DESIGN.md
+ * Phase 1 along with `RiskTier.Notify`. Per `clean-reinstall-no-migrations`
+ * policy, existing rows with `risk_tier='notify'` are not migrated — the
+ * schema CHECK constraint is updated to the 2-tier set and the user
+ * re-seeds via `pa stop && rm ~/.personal-agent/data.db && pa start`.
+ *
+ * Namespace convention per design: `mcp-tool:<serverId>:<toolName>`. The
+ * Claude Code SDK itself exposes MCP tools as `mcp__<serverId>__<toolName>`;
+ * we generate both forms (the namespace form for audit/log clarity, the
+ * double-underscore form for `disallowedTools` which the SDK matches).
+ */
+/** Convert a server's tier to the shared RiskTier enum. */
+export function classifyMcpServerTier(tier) {
+    switch (tier) {
+        case "read":
+            return RiskTier.ReadSensitive;
+        case "approve":
+            return RiskTier.Approve;
+    }
+}
+/** Tool id as it appears in the Claude SDK `disallowedTools` list. */
+export function claudeMcpToolName(serverId, toolName) {
+    return `mcp__${serverId}__${toolName}`;
+}
+/** Tool id as it appears in audit logs / risk reasoning. */
+export function mcpToolNamespaceKey(serverId, toolName) {
+    return `mcp-tool:${serverId}:${toolName}`;
+}
+/**
+ * Parse an MCP tool name. Two on-the-wire conventions are accepted:
+ *
+ *  1. `mcp__<serverId>__<toolName>` (double underscore) — emitted by
+ *     Claude SDK tool_use blocks and Codex `item.name` for MCP invocations.
+ *     The split is on the FIRST `__` after the `mcp__` prefix.
+ *  2. `mcp_<serverId>_<toolName>` (single underscore) — emitted by Gemini
+ *     CLI's `tool_name` field per the `MCP_TOOL_PREFIX = "mcp_"` constant
+ *     baked into Gemini's MCP runtime. Server ids may contain hyphens
+ *     (e.g. `google-workspace`) but never bare underscores, so the split
+ *     is on the FIRST `_` after the `mcp_` prefix.
+ *
+ * Returns null for non-MCP names or malformed inputs. Server ids are
+ * constrained by {@link McpServerIdSchema} to `[a-z0-9-]+`. Tool names
+ * are upstream-defined and may contain underscores or dots; everything
+ * after the chosen separator is treated as the tool name verbatim.
+ */
+export function parseMcpToolName(name) {
+    // Double-underscore form first — exact-prefix match prevents ambiguous
+    // overlap with the single-underscore form (`mcp__` also starts with
+    // `mcp_`).
+    if (name.startsWith("mcp__")) {
+        const rest = name.slice("mcp__".length);
+        const sep = rest.indexOf("__");
+        if (sep <= 0 || sep >= rest.length - 2)
+            return null;
+        return {
+            serverId: rest.slice(0, sep),
+            toolName: rest.slice(sep + 2),
+        };
+    }
+    // Single-underscore form (Gemini). Reject names that fall through to
+    // here without `mcp_` so non-MCP tool names stay null.
+    if (!name.startsWith("mcp_"))
+        return null;
+    const rest = name.slice("mcp_".length);
+    const sep = rest.indexOf("_");
+    if (sep <= 0 || sep >= rest.length - 1)
+        return null;
+    return {
+        serverId: rest.slice(0, sep),
+        toolName: rest.slice(sep + 1),
+    };
+}
+/**
+ * Compute the set of MCP tool names that must be added to `disallowedTools`
+ * for this session. Two rules, independently applied (union):
+ *
+ *   1. `toolAllowlist` enforcement. When a server declares a non-null
+ *      allowlist, every probe-discovered tool *not* in the allowlist is
+ *      blocked — the agent must stay inside the curated subset.
+ *   2. Autonomous approve-tier strip. On autonomous ProcessKeys, every
+ *      probe-discovered tool from an `approve`-tier server is blocked so
+ *      the session cannot drive high-stakes actions without the owner in
+ *      the loop.
+ *
+ * Both rules use literal tool names from `lastProbeStatus.tools` — no
+ * wildcards. The Claude SDK's `disallowedTools` matcher for MCP names is
+ * literal, and a wildcard like `mcp__<id>__*` would also block legitimately
+ * allowlisted tools. The known trade-off: a tool added to the server after
+ * the last probe is NOT in this list, so the autonomous strip is weaker
+ * than a wildcard would be. Operationally the user re-probes after
+ * changing tools; the `rules/mcp.md` policy layer is the soft backstop.
+ */
+export function buildMcpDisallowedTools(input) {
+    const out = [];
+    for (const server of input.servers) {
+        if (!server.enabled)
+            continue;
+        const stripAll = input.autonomous && server.riskTier === "approve";
+        const allowlist = server.toolAllowlist;
+        if (!stripAll && !allowlist)
+            continue;
+        const tools = server.lastProbeStatus?.tools ?? [];
+        const allowed = allowlist ? new Set(allowlist) : null;
+        for (const tool of tools) {
+            if (stripAll) {
+                out.push(claudeMcpToolName(server.id, tool.name));
+                continue;
+            }
+            if (allowed && !allowed.has(tool.name)) {
+                out.push(claudeMcpToolName(server.id, tool.name));
+            }
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=risk.js.map

package/dist/services/mcp/risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../../src/services/mcp/risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAG3D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,aAAa,CAAC;QAChC,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;IAClE,OAAO,QAAQ,QAAQ,KAAK,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IACpE,OAAO,YAAY,QAAQ,IAAI,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY;IAEZ,uEAAuE;IACvE,oEAAoE;IACpE,WAAW;IACX,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;SAC9B,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uDAAuD;IACvD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC5B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;KAC9B,CAAC;AACJ,CAAC;AAcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC;IAEnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC;QACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;YAAE,SAAS;QAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}